CN111401138A

CN111401138A - Countermeasure optimization method for generating countermeasure neural network training process

Info

Publication number: CN111401138A
Application number: CN202010113638.1A
Authority: CN
Inventors: 裴颂文; 沈天马
Original assignee: Cloud Network Suzhou Intelligent Technology Co ltd; University of Shanghai for Science and Technology
Current assignee: Cloud Network Suzhou Intelligent Technology Co ltd; University of Shanghai for Science and Technology
Priority date: 2020-02-24
Filing date: 2020-02-24
Publication date: 2020-07-10
Anticipated expiration: 2040-02-24
Also published as: US20220122348A1; US11315343B1; CN111401138B; WO2021169292A1

Abstract

The invention relates to a countermeasure optimization method for generating a countermeasure neural network training process, which comprises the steps of converting an optimal transmission problem into a solution of an elliptic type monomer-Ampere partial differential equation (MAPD) in a generator G, improving Neumann boundary conditions and expanding discretization of the MAPD to obtain optimal mapping between the generator and a discriminator so as to form a countermeasure network MAGAN in order to solve the n (n >3) -dimensional MAPD. In the process of training the defense network, the defense network can obtain the maximum distance between the two measures by overcoming the loss function of the optimal mapping, and a filtered safety sample is obtained. The effective attack method of the GANs is successfully established, and the precision is improved by 5.3%. In addition, the MAGAN can be stably trained without adjusting the hyper-parameters, and the accuracy of the unmanned target classification and identification system is well improved.

Description

Countermeasure optimization method for generating countermeasure neural network training process

Technical Field

The invention relates to an image processing technology, in particular to a confrontation optimization method for generating a confrontation neural network training process.

Background

In recent years, as a core technology of artificial intelligence, deep learning has made a lot of key breakthroughs in the fields of image, voice, natural language processing and the like, and various methods for generating antagonism examples have been proposed to attack deep neural networks. These methods involve either directly computing gradient image pixels or directly solving for optimization of image pixels.

With the continuous development of deep learning, more and more fields adopt deep learning to replace the traditional intelligent algorithm. However, some fields, such as finance, unmanned driving, etc., require high accuracy, low risk, and particularly high safety, especially autonomous driving. The impact of the challenge sample on the network model cannot be ignored. In the deep learning network, the confrontation samples influence the final learning model through slight noise. And the confrontation sample adopted by the attacker cannot be judged by human senses, so that the judgment and the defense can be carried out only through the neural network. A typical scene is a confrontation sample of an image classification model, and by superimposing a variation amount of a precise center structure on a picture, the classification model is made to make a misjudgment under a condition that the change amount is difficult to be perceived by naked eyes.

In principle, the antagonizing sample calculates a variation for the given sample. The deep learning model learns the segmentation plane in the high-dimensional space by training on the sample, and different measurements on the segmentation plane are used as different classification and discrimination results, as shown in fig. 1.

The human perception cannot be identified after one or more small shifts, but the sample can cross the segmentation plane in the deep learning result space, resulting in a change in the determination result of the machine learning model, as shown in fig. 2.

To date, these optimization problems have been solved using three broad approaches:

(1) by using optimizers such as L-BFGS or Adam (Kingma & Ba, 2015) directly, such as szegdy (2013) and Carlini & Wagner (2016), this optimizer-based approach tends to be slower and more powerful than the other approaches.

(2) Approximation by a single step gradient based technique, such as the fast gradient sign (Goodfellow et al, 2014b) or the least probable class (Kurakin et al, 2016 a). These methods are fast and require only a single forward and backward pass through the object classifier to compute the perturbation.

(3) By approximation based on iterative variants of gradient techniques (Kurakin et al, 2016 a; Moosavi Dezfolio et al, 2016 a; b). These methods use multiple forward and backward passes through the target network to more carefully move the input to the challenge classification.

Currently the countersamples are mainly attacked by the gradient and the encoder. Wherein, the attack samples generated by the encoder of the neural network are superior to the gradient attack mode. Particularly after 2017, GAN is becoming the major network generation tool as it is developed against neural networks. Therefore, GAN-based attack sample models gradually appeared in 2018 to 2019, however their model robustness was too poor due to GAN instability. The problem of GAN convergence is solved herein by optimal mapping at two measures based on the theory of optimal transmission.

GAN is a generative model that contains two networks (a generator network and a discriminator network). At a given noise source, the generator network generates synthetic data, while the discriminator network distinguishes the generated data from the real data. However, GAN is affected by training instability, most recent work on GAN training is dedicated to finding stable training methods, and the current common methods rely on heuristic methods which are extremely sensitive to modification, and the new unstable behavior against neural network training is rarely explained from the internal root of the network. This greatly limits the applicability of GAN to image processing applications.

Disclosure of Invention

The invention provides a confrontation optimization method for generating a confrontation neural network training process aiming at the problem that the convergence of the confrontation neural network (GANs) training used for attack and defense is unstable, in a generator G, an optimal transmission problem is converted into the solution of an elliptic type Monge-Ampere partial differential equation (MAPD), in order to solve the n (n >3) dimensional MAPD, Neumann boundary conditions are improved, the discretization of the MAPD is expanded to obtain the optimal mapping between the generator and a discriminator, and the confrontation network MAGAN is formed. In the process of training the defense network, the defense network can obtain the maximum distance between the two measures by overcoming the loss function of the optimal mapping, and a filtered safety sample is obtained. The solution of MAPDE can constitute a new discriminant distribution function, replacing the Wasserstein distance of WGAN.

The technical scheme of the invention is as follows: an antagonistic optimization method for generating an antagonistic neural network training process specifically comprises the following steps:

1) sending the image data training set and random noise into a generator in an anti-neural network, using generated data output by the generator as actual data of an attack sample and the image data to form two data sets X and Y, inputting the two data sets into a discriminator D in the generator, calculating probability densities rho X and rho Y of the probability densities of X, solving the maximum likelihood estimation value of the actual data and the generated data probability densities, calculating the measure of the actual data and the generated data, solving the numerical solution of an elliptic Monge-Ampere partial differential equation to obtain the optimal mapping between the actual data distribution and the generated data distribution, training the generator by calculating a loss function of the generator to form an attack network in the generator, finally obtaining the optimal mapping U between the attack sample and the actual data, and finishing the attack network training;

2) adding the discriminator D trained in the step 1) into a defense network in the antagonistic neural network, sending an image data training set and random noise into a generator in the antagonistic neural network, using output data of the generator as input data of the defense network, training the defense network through a defense network loss function obtained through the solution of Mongolian Ampere's equation and an optimal transmission theory, in the process of training the defense network, overcoming the loss function of optimal mapping, obtaining the maximum distance between two measures by the defense network, and finally obtaining the output value of the defense network through iterative training, thereby obtaining the filtered safety sample.

The loss function of the generator is:

wherein X, Y correspond to points within sets X and Y; e_x～PxIs the expectation of the true data probability distribution; e_y～PyAn expectation of probability distribution for the attack sample data;

is the expectation of L icpschiz continuous data D_wIs a network of discriminators with weights; d is a discriminator network; g is a generator network; lambda is a penalty coefficient and is a hyper-parameter set by a training network, and E is an expectation;

the loss function of the defense network is:

m is the number of discrete points in each dimension of the network.

The method has the advantages that the countermeasure optimization method for the training process of the countermeasure neural network IS generated, the effective attack method of the GANs IS successfully established, and a plurality of calculation operators are provided to prove that the precision IS improved by 5.3%.

Drawings

FIG. 1 is a schematic diagram of a neural network classification and segmentation plane

FIG. 2 is a schematic diagram of a cross-domain segmentation plane of an attack sample;

FIG. 3 is a schematic of the distribution of numerical initial solutions of MAPD;

FIG. 4 is a schematic diagram of a unit-oriented inward normal vector under Neumann boundary conditions of MAPD;

FIG. 5 is a block diagram of the framework of the improved antagonistic neural network of the present invention;

FIG. 6 is a block diagram of the generation of countermeasure samples and defense networks of the present invention;

FIG. 7 is a flow chart of the attack and defense process of the neural network of the unmanned target classification and identification system of the present invention.

Detailed Description

In order to assist and realize the unmanned driving, the neural network realizes an algorithm identification part of the unmanned driving target classification and identification system for image identification and classification. Mainstream image processing and target recognition mainly employ a Convolutional Neural Network (CNN), and there is an under-fit condition in the space of real data and generated data. Therefore, there are studies on algorithms for providing attack and defense to enhance the robustness of the neural network, but the effect on the black box attack and defense is not good.

To solve this problem, a homoeomorphic mapping of a region to itself is sought, satisfying two conditions: keeping the measure and minimizing the transmission cost. Measure of retention for all of the Polel sets

(Ω is a finite open set), and the map T maps the probability distribution μ to a probability distribution v, denoted T × μ ═ v. The transmission cost of the optimal transmission map T: omega → omega is defined as:

I[s]＝∫_Xc(x,s(x))dx (1)

wherein I is a mapping cost function; c (x, y) is the distance x maps to y; x, y belong to a point within the set.

In this case, Brenier proves that there is a convex function u:Ω → R (R is the whole set of real numbers) whose gradient maps

Is the only optimal transmission map. This convex function is called the Brenier potential energy function (Brenier potential). The Brenier potential obtained by the Jacobian equation meets the Monday-Ampere equation (2), the Jacobian matrix of the gradient mapping is a Hessian matrix of a Brenier potential function,

wherein D is the partial derivative; det is determinant; rho is a measure; x, Y are the full set of x and y, respectively.

The method of Kantorovich is not a good choice, however, driving up more complex methods to efficiently compute the optimal mapping.

In the optimal transmission problem between convex sets, the transmission condition (BC) is also referred to as a second boundary value problem as a second type of boundary condition. The boundary condition may be mapped into set X by boundary nodes, and into set Y by boundary nodes, in view of the gradient that occurs in the transport boundary condition, it is desirable to find the Neumann boundary condition:

according to the formula (5), a boundary normal vector n is defined, and normal vector components corresponding to n dimensions in the boundary normal vector nAn amount of n₁、n₂、...、n_nWhere the vector n is perpendicular to point X (X belongs to a point in the X set because the X set has a boundary and an unspecified point X on the boundary is also in the X set. therefore equation 5 is a qualified boundary condition, whether a domain or X, where X is simply a point within the qualified.),

is the boundary of the set of X, which is the partial derivative with respect to X. Phi is a normal vector calculation function, and is calculated by equation (7). The normal vector component n for each dimension in equation 7 is multiplied by the partial derivative of u under the corresponding dimension, i.e. the difference between the unit step size and the central value of each dimension of the function u is moved forward.

x is n-dimensional, so

Lower index n, i₁、i₂、i₃、…、i_nN in total, representing different dimensions. Because the numerical solution requires discretization, there are m discrete points in each dimension, i.e., i ═ 1,2,3, …, m. The difference is calculated by the five-step method by using front and rear points, namely i +1 and i. Assuming dimension 1, the front and back point index is i₁，(i+1)₁I.e. by

And

rule is as follows: and sequentially taking the x subscript in the first item u back to the unit step length i +1 according to the dimensionality.

The Monday-Ampere equation is solved again with this updated boundary condition to obtain a new numerical solution. Wherein u is^k+1Is the solution for the k +1 time iteration. Because it is monotonic, this scheme relies only on values within the square. When the dimensionality of the MAPDE is greater than 2, there are many nodes around the boundary that directly affect the value of the solution, as shown in fig. 3. This will take more computation time and therefore should pay more attention to the boundaries and use the upper bounds of these monotonic methods for all acceptable boundsTo ensure that a highly accurate numerical solution is obtained. The monotonicity of the method is preserved. First, a boundary is set on the other side of the square area. Then, at the corners, the derivation directions of the other dimensions are limited in the form of tilt constraints. And the allowed directions are limited to a single quadrant, which ensures that the required information will continue to remain within the square area. Next, a new approximation is obtained in the inward direction. Finally, as shown in fig. 4, the above steps are repeated until a suitable boundary is obtained, which corresponds to considering all the support hyperplanes at these points.

The present invention defines several finite difference operators that are employed to approximate the first and second partial derivatives using the central difference. Standard discretization of this equation by center difference:

MA is a discrete solution Monday-Ampere equation (Monge-Ampere PDE); d is partial derivative; f, g are measures. u is a discrete numerical solution to the Monday-Ampere equation.

Wherein the finite difference operator is:

will also follow these directions

The finite difference operator is further computed:

the result of discretization is a variational form of the MA computation operator, to which an additional term will be added to further penalize the non-convexity:

based on newton iterations, the partial derivatives of all nodes need to be calculated. However, when the dimension is larger than 3, it is difficult to obtain all the partial derivatives of high dimension. Although the solution of MAPDE can be discretized by setting step h, the high dimension also makes it difficult for nodes in the mesh to define the context of the node. It can be found that the relative nodes in each dimension are mostly its forward and backward nodes. And the nodes of the central difference in different dimensions are the same node. Therefore, it is proposed to use surrounding gradients instead of global gradients to speed up the high-dimensional convergence.

Iterative expressions of MAPDE under Neumann boundary conditions and initialized expressions at the beginning of solving equations can be obtained:

the MAPD can be solved to obtain the best mapping u (x) between the actual data distribution and the generated distribution, then the cost function for the OT problem can be obtained as follows, which trains how efficiently the generator generates the real data equation 14 is to solve the maximum likelihood estimate of the real data and the generated data, and the maximum of equation 15 is solved by M L E to determine the distribution of the real data and the generated data.

The optimal mapping u (x) is obtained by solving the Montanian as shown by the dashed rectangle in FIG. 5.

And sending the image data training set and the random noise into a generator, outputting data by the generator as an attack sample and real image data, and correspondingly obtaining a brand-new discriminator D formed by two data sets X and Y entering a dotted rectangle. The measure of the real data and the measure of the generated data are distinguished by a brand-new discriminator D, and the generator G continuously resists the discriminator D in the training process, so that effective attack is carried out. The optimal mapping u (x) is obtained by solving the Mongolian equation, and the generation of the attack countermeasures sample is realized by the generator G trained in the figure 5. I.e. the generator internally constitutes the attack network. In training the discriminator D shown in fig. 5, the upper bound of the loss function of the generator of equation 16 is solved; on the contrary, in the process of training the generator G shown in fig. 5, the lower bound of the loss function of the generator of formula 16 is obtained, and finally a good countermeasure effect is obtained. The loss function of the Monge-Kantorovich transmission problem replaces the Wasserstein distance of the WGAN as a new divergence.

At the start of training, only the true data of the image data is used to obtain the probability density PX of X. Probability density ρ Y of attack sample Y, to generate distribution P_gTrue data distribution P_rData is generated because the solution of MAPD results in P_gTends to P_r. P may then be used according to Neumann boundary conditions_rAnd P_gThe appropriate boundary is calculated by equation (13). Next, a Finite Difference Method (FDM) is used to obtain a system of equations F [ u ]]0 and by newtonThe system of equations is solved iteratively.

The method comprises the following implementation steps:

step one, calculating probability density rho X of X and probability density rho Y of Y

Solving the maximum likelihood estimation value of the real data and the generated data;

step three, calculating the measure of the real data and the generated data;

step four, calculating a first type boundary of the MAPD;

step five, calculating the real data distribution P_rAnd generating a distribution P_gOptimal u (x) in (a);

step six, iteration gradient values;

step seven, calculating a loss function;

and circulating the steps until the cost function is converged.

The network is adopted by the MAGAN to be applied to a countermeasure sample generation network. As shown in fig. 5, the black box attack and the white box attack are more efficiently implemented by the good robustness of the MAGAN, so as to form an attack network. In order to better defend against the attack of the sample, the attack sample generated by the generator G is used to train the defense network, and the solution of the Monday-Ampere equation is used to strengthen the robustness as shown in fig. 6. The discriminator D in fig. 6 corresponds to the structure within the dashed box in fig. 5, which contains the numerical solution of the partial differential equation. When the discriminators are applied to the lower discriminator network of fig. 6 after training, the filtered samples are subjected to training of the defense network. The sample of the generator G is used as input data of the defense network, and the input training data has strong robustness of black box and white box attacks, so that the input data is subjected to logistic regression through a loss function of the defense network to calculate cross entropy, real data and artificial fake data are separated, an isolation effect is achieved, and a good defense effect is achieved.

Wherein the loss function for the generator is:

the loss function of the defense network is:

after the attack network in fig. 5 is trained, the defense network in fig. 6 is implemented by adding a target attack network, as shown in fig. 7. In the right box of fig. 7, by setting the loss function of the generator, the generator G can learn the measure of the attack sample to calculate the optimal mapping U. The generator can then derive attack samples for the target network based on the input data and random noise, thereby making an effective attack. The target network refers to a network needing attack, namely a known network trained by others. In the left box of fig. 7, the output data of the generator G is taken as input data of the defense network,by passingThe right frame trains the defense network according to the solution of the Mongolian Ampere equation and the loss function obtained from the optimal transmission theory, equation 17. Equation 16 is a generator network, and when the defense network trains, the loss function of the generator does not participate in the training. In the course of training the defense network, the defense network can obtain the maximum distance between the two measures by overcoming the loss function of the optimal mapping. Finally, an output value of the defense network can be obtained through iterative training, and the unmanned target classification and recognition system can be well helped to judge the attack sample.

Claims

1. An antagonistic optimization method for generating an antagonistic neural network training process is characterized by comprising the following steps:

2. The method of generating an antagonistic optimization to the neural network training process of claim 1, wherein the loss function of the generator is:

wherein X, Y correspond to points within sets X and Y; e_x～PxIs the expectation of the true data probability distribution; e_y～PyFor attacking samplesA desire for a probability distribution of data;

the loss function of the defense network is:

m is the number of discrete points in each dimension of the network.